MPEG-2 Video Extension EUVD-2026-100191

Exploitation requires that the Microsoft MPEG-2 Video Extension (versions 1.0.0.0 up to but not including 1.2.32.0) be installed on the target Windows system - it is an optional Microsoft Store codec, not a default Windows component, which materially limits the exposed population. The attacker must deliver a specially crafted MPEG-2 media file, and a user must actively open or play it in an application that invokes the extension (UI:R in the CVSS vector); there is no automatic or unauthenticated-remote trigger without this interaction. No elevated privileges or prior authentication are needed on the target (PR:N), and code executes in the context of the user who opens the file. Primary limiting factors: the codec must be present, the victim must be induced to open attacker-controlled content, and SSVC rates the flaw as not automatable.

Signals are mixed and point to elevated-but-not-emergency priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects a network-reachable, low-complexity, unauthenticated flaw with total compromise of confidentiality, integrity and availability - but the UI:R metric means it is not self-propagating and requires a victim to open a malicious file. CISA's SSVC decision framework reinforces a measured view: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-exploited precisely because user interaction is needed), while Technical Impact=total aligns with the CVSS C:H/I:H/A:H. There is no CISA KEV listing and no EPSS score was provided in the input, and no public exploit is referenced, so there is no evidence of active exploitation or available weaponization at this time. This is best characterized as a genuinely high-impact memory-corruption RCE that is realistically exploited only through social engineering, making it a patch-soon item rather than a drop-everything emergency absent further exploitation signals. Missing data to note explicitly: no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified; POC availability is unconfirmed; and exact patched build is stated by version range (EUVD) but not independently verified against an MSRC advisory body beyond the reference link.

An attacker crafts a malformed MPEG-2 video file whose stream data triggers the heap-based buffer overflow in the Microsoft MPEG-2 Video Extension codec, then delivers it via email attachment, a malicious website, or a shared link. When the victim opens or plays the file in an application that uses the extension (e.g., Films & TV / Media Player), the parser overflows a heap buffer and the attacker achieves arbitrary code execution in the user's security context. No public exploit is identified at time of analysis, and successful exploitation depends on the victim choosing to open the file (UI:R).